CVE-2026-89733

Received Received - Intake

Use-After-Free in Linux Kernel USB Gadget UVC Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89733

EUVD

EUVD-2026-76645

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's USB gadget UVC (USB Video Class) driver. It occurs when error paths in the uvc_function_bind() and uvc_function_unbind() functions fail to properly clear dangling pointers after freeing memory. Specifically, pointers like uvc->control_req and uvc->control_buf remain invalid after being freed, which can lead to memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB gadget UVC (USB Video Class) functionality. Detection requires checking kernel logs for errors related to uvc_function_bind or uvc_function_unbind, such as use-after-free (UAF) warnings. Commands like dmesg | grep -i uvc or journalctl -k | grep -i uvc may help identify issues.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or potential privilege escalation on affected Linux systems. Users might experience kernel panics, unexpected reboots, or denial-of-service conditions. Systems using USB video gadgets with the vulnerable kernel code are at risk.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this vulnerability. If immediate patching is not possible, disable the USB gadget UVC functionality as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-89733. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70